NLnet Labs Unbound up to and including version 1.26.1 contains a vulnerability identified as CVE-2026-109125. The vulnerability has a medium severity with a CVSS score of 5.3. It involves an observable issue that impacts the integrity of the system but does not affect confidentiality or availability. The affected versions include multiple specific builds primarily related to Ubuntu distributions. No public exploit code or known exploitation in the wild has been reported.
NLnet Labs Unbound versions from 1.22.0 up to and including 1.26.1 contain a vulnerability identified as CVE-2026-97206. This vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, and affects multiple Ubuntu package versions. The flaw does not impact confidentiality or integrity but results in a high impact on availability.
CVE-2026-96405 is a medium severity vulnerability affecting NLnet Labs Unbound versions up to and including 1.26.1. The vulnerability relates to limitations in compression handling, causing an availability impact without compromising confidentiality or integrity. No known exploits are reported in the wild. The affected versions include specific Ubuntu package versions of Unbound. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a moderate risk primarily due to potential denial of service.
A vulnerability exists in NLnet Labs Unbound up to and including version 1.26.1, affecting specific Ubuntu package versions. The flaw has a CVSS 3.1 base score of 6.5, indicating medium severity. It does not impact confidentiality but can cause integrity loss and high availability impact. No public exploits or known active exploitation are reported. The exact technical details of the vulnerability are not provided in the available data.
A low-severity vulnerability identified as CVE-2026-35501 affects NLnet Labs Unbound versions from 1.0.1 up to and including 1.26.1. The vulnerability has a CVSS score of 3.7, indicating low impact, with no confidentiality or availability impact but limited integrity impact. The affected versions include specific Ubuntu package versions of Unbound. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
OpenStack Cinder through version 29.0.0 contains a vulnerability that allows cross-project information disclosure. This issue has a medium severity with a CVSS score of 4.3, indicating limited confidentiality impact without integrity or availability effects.
OpenStack Manila versions before 23.0.1 contain multiple vulnerabilities in API operations that allow an attacker with low privileges to cause a critical impact on confidentiality, integrity, and availability. The vulnerability has a very high CVSS score of 9.9, indicating severe risk. The affected versions include multiple Ubuntu package releases of Manila. No public exploit or known in-the-wild exploitation is reported. The vulnerability is classified as critical.
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 4.22.18. See the following advisory for the container images for
this release:
https://access.redhat.com/errata/RHSA-2026:79154
Security Fix(es):
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege
escalation via incorrect Punycode label processing (CVE-2026-39821)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.22 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.
Dulwich versions from 0.23.1 before 1.2.8 contain a path traversal vulnerability that can lead to high impact on confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 7.8, indicating high severity. It requires local access with low attack complexity and no privileges but user interaction. The vulnerability affects multiple specific versions of Dulwich, including various Ubuntu package builds. No public exploits or known active exploitation have been reported.
FreeRDP versions from 2.0.0 up to but not including 3.32.0 contain an improper certificate validation vulnerability. This flaw can lead to a security breach where an attacker might exploit the improper validation of certificates. The vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity level with high impact on confidentiality and integrity but no impact on availability.
FreeRDP versions before 3.32.0 contain a null-pointer dereference vulnerability that can cause a denial of service. The flaw affects multiple Ubuntu package versions of FreeRDP. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with no confidentiality or integrity impact but potential availability impact.
FreeRDP versions before 3.32.1 contain a heap-based buffer overflow vulnerability in the server component. This flaw allows an attacker with local privileges to potentially execute arbitrary code or cause a denial of service. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.
FreeRDP versions before 3.32.1 contain a heap out-of-bounds read vulnerability that can lead to information disclosure. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity. It affects multiple specific Ubuntu package versions of FreeRDP. No public exploits or known active exploitation have been reported.
FreeRDP versions prior to 3.32.1 contain a heap-based out-of-bounds read vulnerability in the WinP component. This flaw can be triggered remotely without privileges and requires user interaction. The vulnerability impacts confidentiality but does not affect integrity or availability.
FreeRDP version 3.32.0 contains a use-after-free vulnerability in the drdynvc component. This vulnerability can cause a denial of service by crashing the affected system. The issue has a CVSS score of 6.5, indicating a medium severity level. Multiple specific Ubuntu package versions of FreeRDP are affected.
A vulnerability was found in device-mapper-multipath (multipath-tools) affecting specific Ubuntu package versions. The flaw allows a local user to trigger an issue that impacts confidentiality and availability with no privileges required. The CVSS score is 5.1, indicating a medium severity level.
A medium severity vulnerability (CVE-2026-91487) exists in the Oracle Java SE Compiler component affecting multiple OpenJDK 8 versions. The flaw has a CVSS 3.1 base score of 4.8, indicating low complexity and network attack vector but requiring high attack complexity and no privileges or user interaction. The vulnerability impacts confidentiality and integrity but not availability. No known exploits in the wild have been reported. No patch or remediation details are provided in the available data.
A high-severity vulnerability (CVE-2026-91484) exists in the Java plugin component of Oracle Java SE, specifically affecting OpenJDK 8 versions listed. The vulnerability has a CVSS 3.1 score of 7.5, indicating high impact on confidentiality and integrity with no impact on availability. It requires local attack vector, high attack complexity, and low privileges without user interaction. No public exploits or cloud service implications are reported.
A low-severity vulnerability (CVE-2026-91477) exists in the Oracle JavaFX component of Oracle Java SE, affecting multiple specific versions. The vulnerability has a CVSS score of 3.1, indicating limited impact primarily on confidentiality with no impact on integrity or availability. It requires network access with high attack complexity and user interaction. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
CVE-2026-91464 is a medium severity vulnerability affecting specific builds of OpenJDK 8, including versions distributed with Ubuntu 16.04 through 26.10. The flaw impacts Oracle Java SE and Oracle GraalVM for JDK. It has a CVSS 3.1 base score of 5.3, indicating a network attack vector with high complexity, no privileges required, and user interaction needed. The vulnerability allows high confidentiality impact but does not affect integrity or availability.